From: Constantin Gavrilescu <costi@...>
Date: 2007-09-13T03:26:10+09:00
Subject: Re: secure file writing (escaping characters from the file n

Felix Windt wrote:
> If you only need this to work on POSIX compatible filesystems, all you 
> need
> to remove are "/" (slash character, as it separates path components) and
> \000 (nul, as it terminates strings in many languages) as POSIX file 
> names
> can accept all other ASCII characters. 

<snip>

That's interesting...

irb(main):001:0> File.open("aa.php\000continue.jpg", "w")
=> #<File:aa.php>

Creates the file aa.php. Welcome remote code execution vulnerabilities.

irb(main):002:0> File.open("../aaa", "w")
=> #<File:../aaa>

Directory traversal. Creates "aaa" in the parent directory.

irb(main):002:0> File.open("bbb\\bbb.tst", "w")
=> #<File:bbb\bbb.tst>

Linux accepts it. I guess it can be a directory traversal in windows. 
Samba exports it as BRRFFZ~N.TST
-- 
Posted via http://www.ruby-forum.com/.